duxingchen/KCGL
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 采购模块重构 — 权限驱动的可见性 + 严格操作权限

Browse Source 
## purchase.py
- GET /purchase (列表): @jwt_required, 有权限看同公司全部/无权限只看自己
- POST /purchase (创建): @jwt_required, 任何登录用户可提交
- GET /purchase/<id> (详情): @jwt_required, 自己的或有权者可见
- PATCH /purchase/<id>/approve (审批): @permission_required('inbound_purchase:operation')
  不再硬编码 SUPERVISOR 角色, 有操作权限即可审批
- GET /purchase/approvers, /auto-fill, /search-material: @jwt_required (开放给创建流程)
- 新增 _user_has_purchase_perm() 统一权限检查
- 移除所有硬编码 role in ('SUPERVISOR','SUPER_ADMIN')

## purchase_service.py
- send_email → send_email_async (采购审批邮件异步发送)

## purchase/index.vue
- canApprove: 仅检查 inbound_purchase:operation (菜单权限≠审批权限)
- customUpload: 修复 v-model:file-list 重复推入导致图片双份显示
- auth.py → purchase.py 权限前缀统一
This commit is contained in:
yueli
2026-07-16 11:25:53 +08:00
parent 0b75740ae0
commit 128985af17
3 changed files with 187 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
inventory-backend/app/api/v1/purchase.py
View File

@ -1,6 +1,6 @@
import traceback
from flask import Blueprint, request, jsonify, current_app
from flask_jwt_extended import jwt_required, get_jwt_identity
from flask_jwt_extended import jwt_required, get_jwt, get_jwt_identity
from app.services.purchase_service import PurchaseService
from app.utils.decorators import permission_required
@ -15,20 +15,33 @@ def get_current_user_id():
def get_current_user_role():
"""获取当前用户角色"""
from flask_jwt_extended import get_jwt
claims = get_jwt()
return claims.get('role')
def _user_has_purchase_perm():
"""检查当前用户是否有 inbound_purchase 权限（菜单或任意操作权限）"""
claims = get_jwt()
role = claims.get('role', '')
user_company = claims.get('company_name', '')
if role.upper() in ('SUPER_ADMIN', 'SUPERVISOR'):
return True
from app.services.auth_service import AuthService
perm_dict = AuthService.get_user_permissions(role, company_name=user_company)
all_perms = perm_dict.get('menus', []) + perm_dict.get('elements', [])
return 'inbound_purchase' in all_perms or any(
p.startswith('inbound_purchase:') for p in all_perms
)
# --------------------------------------------------------
# 1. 采购申请列表
# GET /api/v1/purchase
# --------------------------------------------------------
@purchase_bp.route('', methods=['GET'])
@jwt_required()
@permission_required('inbound_buy')
def get_purchase_list():
"""获取采购申请列表"""
"""采购申请列表：有权限看同公司全部，无权限只看自己的"""
try:
page = int(request.args.get('page', 1))
per_page = int(request.args.get('limit', 20))
@ -36,15 +49,12 @@ def get_purchase_list():
status = int(status) if status is not None else None
user_id = get_current_user_id()
role = get_current_user_role()
# 普通用户（SUPERVISOR 和 SUPER_ADMIN 除外）只看自己提交的
is_admin = role in ('SUPERVISOR', 'SUPER_ADMIN')
can_view_all = _user_has_purchase_perm()
result = PurchaseService.get_purchase_list(
page=page,
per_page=per_page,
requester_id=None if is_admin else user_id,
requester_id=None if can_view_all else user_id,
status=status
)
@ -60,9 +70,8 @@ def get_purchase_list():
# --------------------------------------------------------
@purchase_bp.route('', methods=['POST'])
@jwt_required()
@permission_required('inbound_buy')
def create_purchase_request():
"""创建采购申请"""
"""创建采购申请（任何登录用户可提交）"""
try:
data = request.get_json()
if not data:
@ -83,10 +92,15 @@ def create_purchase_request():
purchase = PurchaseService.create_purchase_request(data, requester_id=user_id)
# ★ Fail-Closed: 创建响应剥离价格字段
resp = purchase.to_dict()
for k in ('unit_price', 'total_price', 'tax_rate'):
resp.pop(k, None)
return jsonify({
'code': 200,
'msg': '创建成功',
'data': purchase.to_dict()
'data': resp
}), 200
except ValueError as e:
@ -102,19 +116,15 @@ def create_purchase_request():
# --------------------------------------------------------
@purchase_bp.route('/<int:purchase_id>', methods=['GET'])
@jwt_required()
@permission_required('inbound_buy')
def get_purchase_detail(purchase_id):
"""获取采购申请详情"""
"""采购申请详情：自己的无需权限，别人的需要 inbound_purchase"""
try:
purchase = PurchaseService.get_purchase_by_id(purchase_id)
if not purchase:
return jsonify({'code': 404, 'msg': '采购申请不存在'}), 404
# 普通用户只能看自己的
user_id = get_current_user_id()
role = get_current_user_role()
is_admin = role in ('SUPERVISOR', 'SUPER_ADMIN')
if not is_admin and purchase['requester_id'] != user_id:
if purchase['requester_id'] != user_id and not _user_has_purchase_perm():
return jsonify({'code': 403, 'msg': '无权查看此申请'}), 403
return jsonify({'code': 200, 'msg': '获取成功', 'data': purchase}), 200
@ -128,15 +138,11 @@ def get_purchase_detail(purchase_id):
# --------------------------------------------------------
@purchase_bp.route('/<int:purchase_id>/approve', methods=['PATCH'])
@jwt_required()
@permission_required('inbound_buy')
@permission_required('inbound_purchase:operation')
def approve_purchase_request(purchase_id):
"""审批采购申请"""
"""审批采购申请：必须有操作权限（inbound_purchase:operation）"""
try:
user_id = get_current_user_id()
role = get_current_user_role()
if role not in ('SUPERVISOR', 'SUPER_ADMIN'):
return jsonify({'code': 403, 'msg': '只有主管或超级管理员可以审批'}), 403
data = request.get_json() or {}
action = data.get('action', 'approve')
@ -156,7 +162,11 @@ def approve_purchase_request(purchase_id):
)
msg = '审批通过' if action == 'approve' else '已驳回'
return jsonify({'code': 200, 'msg': msg, 'data': purchase.to_dict()}), 200
# ★ Fail-Closed: 审批响应剥离价格字段
resp = purchase.to_dict()
for k in ('unit_price', 'total_price', 'tax_rate'):
resp.pop(k, None)
return jsonify({'code': 200, 'msg': msg, 'data': resp}), 200
except ValueError as e:
return jsonify({'code': 400, 'msg': str(e)}), 400
@ -171,9 +181,8 @@ def approve_purchase_request(purchase_id):
# --------------------------------------------------------
@purchase_bp.route('/approvers', methods=['GET'])
@jwt_required()
@permission_required('inbound_buy')
def get_purchase_approvers():
"""获取可选审批人列表（主管+超管）"""
"""获取可选审批人列表（创建采购申请时选择审批人用）"""
try:
from app.models.system import SysUser
users = SysUser.query.filter(
@ -199,7 +208,6 @@ def get_purchase_approvers():
# --------------------------------------------------------
@purchase_bp.route('/auto-fill', methods=['GET'])
@jwt_required()
@permission_required('inbound_buy')
def auto_fill_purchase():
"""根据名称或规格自动补全另一个字段"""
try:
@ -219,7 +227,7 @@ def auto_fill_purchase():
# --------------------------------------------------------
@purchase_bp.route('/approved-unstocked', methods=['GET'])
@jwt_required()
@permission_required('inbound_buy')
@permission_required('inbound_purchase')
def get_approved_unstocked_requests():
"""获取已审批通过且未入库的采购申请列表"""
try:
@ -243,7 +251,6 @@ def get_approved_unstocked_requests():
# --------------------------------------------------------
@purchase_bp.route('/search-material', methods=['GET'])
@jwt_required()
@permission_required('inbound_buy')
def search_material_for_purchase():
"""物料基础信息搜索接口，支持分页，用于采购申请弹窗"""
try:

16
inventory-backend/app/services/purchase_service.py
View File

@ -128,7 +128,7 @@ class PurchaseService:
@staticmethod
def get_purchase_list(page=1, per_page=20, requester_id=None, status=None):
"""获取采购申请列表，普通用户只看自己的，主管/超管看全部"""
"""获取采购申请列表，普通用户只看自己的，主管/超管看同公司全部"""
from app.utils.decorators import get_current_company_filter
from app.models.system import SysUser
from sqlalchemy import or_
@ -141,7 +141,7 @@ class PurchaseService:
if status is not None:
query = query.filter(PurchaseRequest.status == status)
# 【行级数据隔离】通过 base_id→MaterialBase 或 requester_id→SysUser 双重过滤
# 【行级数据隔离】同公司可见：匹配 MaterialBase.company_name 或 SysUser.department
company_limit = get_current_company_filter()
if company_limit is not None:
query = query.outerjoin(MaterialBase, PurchaseRequest.base_id == MaterialBase.id) \
@ -298,7 +298,7 @@ class PurchaseService:
def _notify_new_request(purchase):
"""发送新申请邮件给审批人"""
try:
from app.utils.email_service import send_email
from app.utils.email_service import send_email_async
from app.models.system import SysUser
if not purchase.approver_id:
@ -324,7 +324,7 @@ class PurchaseService:
此邮件由系统自动发送，请勿回复。
"""
send_email(approver.email, subject, content)
send_email_async(approver.email, subject, content)
except Exception as e:
try:
from flask import current_app
@ -336,7 +336,7 @@ class PurchaseService:
def _notify_approved(purchase):
"""审批通过后通知申请人"""
try:
from app.utils.email_service import send_email
from app.utils.email_service import send_email_async
from app.models.system import SysUser
requester = db.session.get(SysUser, purchase.requester_id)
@ -352,7 +352,7 @@ class PurchaseService:
此邮件由系统自动发送，请勿回复。
"""
send_email(requester.email, subject, content)
send_email_async(requester.email, subject, content)
except Exception as e:
try:
from flask import current_app
@ -364,7 +364,7 @@ class PurchaseService:
def _notify_rejected(purchase):
"""审批驳回后通知申请人"""
try:
from app.utils.email_service import send_email
from app.utils.email_service import send_email_async
from app.models.system import SysUser
requester = db.session.get(SysUser, purchase.requester_id)
@ -382,6 +382,6 @@ class PurchaseService:
此邮件由系统自动发送，请勿回复。
"""
send_email(requester.email, subject, content)
send_email_async(requester.email, subject, content)
except Exception as e:
print(f"[Email] 采购申请驳回通知失败: {e}")

249
inventory-web/src/views/purchase/index.vue
View File

@ -24,12 +24,12 @@
<el-table-column prop="spec_model" label="规格型号" min-width="120" show-overflow-tooltip />
<el-table-column prop="quantity" label="数量" width="80" align="center" />
<el-table-column prop="purchase_date" label="采购日期" width="110" />
<el-table-column label="不含税单价" width="110" align="right">
<el-table-column label="含税单价" width="110" align="right">
<template #default="{ row }">
{{ row.unit_price ? '¥' + Number(row.unit_price).toFixed(2) : '-' }}
</template>
</el-table-column>
<el-table-column label="不含税总价" width="120" align="right">
<el-table-column label="含税总价" width="120" align="right">
<template #default="{ row }">
{{ row.total_price ? '¥' + Number(row.total_price).toFixed(2) : '-' }}
</template>
@ -71,114 +71,116 @@
/>
<!-- ========== 新建/编辑弹窗 ========== -->
<el-dialog v-model="formDialogVisible" :title="dialogTitle" width="700px" destroy-on-close :close-on-click-modal="false" :close-on-press-escape="false">
<el-form ref="formRef" :model="form" label-width="110px">
<el-dialog v-model="formDialogVisible" :title="dialogTitle" width="750px" destroy-on-close :close-on-click-modal="false" :close-on-press-escape="false">
<el-form ref="formRef" :model="form" label-width="100px">
<el-row :gutter="20">
<el-col :span="24">
<el-form-item label="采购物品" required>
<el-select
v-model="materialBaseId"
filterable
remote
reserve-keyword="true"
clearable
placeholder="输入名称或规格搜索..."
:remote-method="handleSearchMaterialDebounced"
:loading="searchLoading"
style="width: 100%"
@change="onMaterialSelected"
default-first-option="true"
popper-class="long-dropdown"
v-loadmore="handleLoadMoreMaterials"
@visible-change="onMaterialDropdownVisibleChange"
>
<el-option
v-for="item in materialOptions"
:key="item.id"
:label="item.name"
:value="item.id"
<!-- ── 物料信息 ── -->
<div class="form-section">
<div class="section-title"><span>物料信息</span></div>
<el-row :gutter="16">
<el-col :span="24">
<el-form-item label="采购物品" required>
<el-select
v-model="materialBaseId" filterable remote reserve-keyword="true" clearable
placeholder="输入名称或规格搜索..." :remote-method="handleSearchMaterialDebounced"
:loading="searchLoading" style="width: 100%" @change="onMaterialSelected"
default-first-option="true" popper-class="long-dropdown"
v-loadmore="handleLoadMoreMaterials" @visible-change="onMaterialDropdownVisibleChange"
>
<el-option v-for="item in materialOptions" :key="item.id" :label="item.name" :value="item.id">
<div style="display: flex; justify-content: space-between; align-items: center;">
<span>{{ item.name }}</span>
<span style="color: #999; font-size: 12px;">{{ item.spec_model || '-' }}</span>
</div>
</el-option>
<li v-if="loadingMore" class="el-select-dropdown__item loading-more" style="text-align:center;color:#999;cursor:default;"><span>加载中...</span></li>
</el-select>
<div v-if="autoFillHint" style="font-size: 12px; color: #67C23A; margin-top: 4px;">{{ autoFillHint }}</div>
</el-form-item>
</el-col>
<el-col :span="8">
<el-form-item label="规格型号">
<el-input v-model="form.spec_model" placeholder="自动填充" clearable />
</el-form-item>
</el-col>
<el-col :span="8">
<el-form-item label="采购数量" required>
<el-input-number v-model="form.quantity" :min="1" :controls="false" style="width: 100%;" />
</el-form-item>
</el-col>
<el-col :span="8">
<el-form-item label="采购日期" required>
<el-date-picker v-model="form.purchase_date" type="date" value-format="YYYY-MM-DD" placeholder="选择日期" style="width: 100%;" />
</el-form-item>
</el-col>
</el-row>
</div>
<!-- ── 价格与审批 ── -->
<div class="form-section">
<div class="section-title"><span>价格与审批</span></div>
<el-row :gutter="16">
<el-col :span="8">
<el-form-item label="含税单价">
<el-input-number v-model="form.unit_price" :min="0" :precision="2" :controls="false" style="width: 100%;" placeholder="¥" @change="onUnitPriceChange" />
</el-form-item>
</el-col>
<el-col :span="8">
<el-form-item label="含税总价">
<el-input-number v-model="form.total_price" :min="0" :precision="2" :controls="false" style="width: 100%;" placeholder="¥" @change="onTotalPriceChange" />
</el-form-item>
</el-col>
<el-col :span="8">
<el-form-item label="税率">
<el-select v-model="form.tax_rate" style="width: 100%;" @change="onTaxRateChange">
<el-option label="0%" :value="0" />
<el-option label="1%" :value="1" />
<el-option label="6%" :value="6" />
<el-option label="13%" :value="13" />
</el-select>
</el-form-item>
</el-col>
<el-col :span="12">
<el-form-item label="审批人" required>
<el-select v-model="form.approver_id" placeholder="请选择审批人" style="width: 100%;" filterable>
<el-option v-for="u in approvers" :key="u.id" :label="u.username" :value="u.id" />
</el-select>
</el-form-item>
</el-col>
<el-col :span="12">
<el-form-item label="商家链接">
<el-input v-model="form.supplier_link" placeholder="https://" clearable />
</el-form-item>
</el-col>
</el-row>
</div>
<!-- ── 备注与图片 ── -->
<div class="form-section">
<div class="section-title"><span>备注与凭证</span></div>
<el-row :gutter="16">
<el-col :span="24">
<el-form-item label="备注">
<el-input v-model="form.remark" type="textarea" :rows="2" placeholder="备注信息（选填）" />
</el-form-item>
</el-col>
<el-col :span="24">
<el-form-item label="图片凭证" required id="upload-purchase-images">
<el-upload
v-model:file-list="fileList"
:http-request="customUpload"
:on-remove="handleRemoveImage"
:before-upload="beforeAvatarUpload"
accept="image/jpeg,image/png,image/gif,image/webp"
multiple
list-type="picture-card"
>
<div style="display: flex; justify-content: space-between; align-items: center;">
<span>{{ item.name }}</span>
<span style="color: #999; font-size: 12px;">{{ item.spec_model || '-' }}</span>
</div>
</el-option>
<li v-if="loadingMore" class="el-select-dropdown__item loading-more" style="text-align:center;color:#999;cursor:default;">
<span>加载中...</span>
</li>
</el-select>
<div v-if="autoFillHint" style="font-size: 12px; color: #67C23A; margin-top: 4px;">{{ autoFillHint }}</div>
</el-form-item>
</el-col>
<el-col :span="12">
<el-form-item label="规格型号">
<el-input v-model="form.spec_model" placeholder="从物料列表选择后自动填充" clearable />
</el-form-item>
</el-col>
<el-col :span="12">
<el-form-item label="采购数量" required>
<el-input-number v-model="form.quantity" :min="1" style="width: 100%;" />
</el-form-item>
</el-col>
<el-col :span="12">
<el-form-item label="采购日期" required>
<el-date-picker v-model="form.purchase_date" type="date" value-format="YYYY-MM-DD" placeholder="选择日期" style="width: 100%;" />
</el-form-item>
</el-col>
<el-col :span="12">
<el-form-item label="审批人" required>
<el-select v-model="form.approver_id" placeholder="请选择审批人" style="width: 100%;" filterable>
<el-option v-for="u in approvers" :key="u.id" :label="u.username" :value="u.id" />
</el-select>
</el-form-item>
</el-col>
<el-col :span="8">
<el-form-item label="不含税单价">
<el-input-number v-model="form.unit_price" :min="0" :precision="2" style="width: 100%;" @change="onUnitPriceChange" />
</el-form-item>
</el-col>
<el-col :span="8">
<el-form-item label="不含税总价">
<el-input-number v-model="form.total_price" :min="0" :precision="2" style="width: 100%;" @change="onTotalPriceChange" />
</el-form-item>
</el-col>
<el-col :span="8">
<el-form-item label="税率">
<el-select v-model="form.tax_rate" style="width: 100%;" @change="onTaxRateChange">
<el-option label="0%" :value="0" />
<el-option label="1%" :value="1" />
<el-option label="6%" :value="6" />
<el-option label="13%" :value="13" />
</el-select>
</el-form-item>
</el-col>
<el-col :span="24">
<el-form-item label="商家链接">
<el-input v-model="form.supplier_link" placeholder="商家地址链接" clearable />
</el-form-item>
</el-col>
<el-col :span="24">
<el-form-item label="备注">
<el-input v-model="form.remark" type="textarea" :rows="2" placeholder="备注信息（选填）" />
</el-form-item>
</el-col>
<el-col :span="24">
<el-form-item label="图片上传" required id="upload-purchase-images">
<el-upload
v-model:file-list="fileList"
:http-request="customUpload"
:on-remove="handleRemoveImage"
:before-upload="beforeAvatarUpload"
accept="image/jpeg,image/png,image/gif,image/webp"
multiple
list-type="picture-card"
>
<el-icon><Plus /></el-icon>
</el-upload>
</el-form-item>
</el-col>
</el-row>
</div>
</el-form>
<template #footer>
@ -334,8 +336,10 @@ const form = ref({
})
// --- 计算属性 ---
// 审批按钮仅对拥有操作权限的用户可见（菜单权限不等于审批权限）
const canApprove = computed(() => {
return userStore.role === 'SUPER_ADMIN' || userStore.role === 'SUPERVISOR'
return userStore.role === 'SUPER_ADMIN'
|| userStore.hasPermission('inbound_purchase:operation')
})
// --- 工具函数 ---
@ -558,9 +562,9 @@ const customUpload = async (options: any) => {
if (res.code === 200) {
const newUrl = res.data.url
form.value.images!.push(newUrl)
// 同步更新 fileList，触发 el-upload UI 刷新
fileList.value.push({ name: newUrl.split('/').pop(), url: getImageUrl(newUrl) })
onSuccess(res)
// ★ v-model:file-list 已自动管理列表，onSuccess 通知 el-upload 更新状态即可
// 传入 { url } 让 el-upload 正确设置文件预览 URL
onSuccess({ url: getImageUrl(newUrl) })
} else {
ElMessage.error(res.msg || '上传失败')
onError(new Error(res.msg))
@ -682,4 +686,35 @@ onMounted(() => {
<style scoped>
.app-container { padding: 20px; }
.filter-container { display: flex; align-items: center; gap: 12px; flex-wrap: wrap; }
/* 表单分组 */
.form-section {
background: #fafbfc;
border: 1px solid #ebeef5;
border-radius: 6px;
padding: 12px 16px 4px;
margin-bottom: 14px;
}
.form-section .section-title {
font-size: 13px;
font-weight: 600;
color: #303133;
margin-bottom: 10px;
padding-bottom: 8px;
border-bottom: 1px solid #ebeef5;
}
.form-section .section-title span {
position: relative;
padding-left: 10px;
}
.form-section .section-title span::before {
content: '';
position: absolute;
left: 0;
top: 2px;
bottom: 2px;
width: 3px;
background: #409EFF;
border-radius: 2px;
}
</style>